Nordlicht Reisen GmbH, a fictional travel agency, stores thousands of receipts as blobs every month. After a quarter, hardly anyone reads them, and after ten years they may be deleted. In between, someone accidentally overwrites a file, and a copy in a second region is wanted as well. This lesson shows which Blob Storage features make that run without manual work.
This lesson covers in the study guide: create and configure containers, configure storage tiers, configure lifecycle management, configure blob versioning, configure object replication.
Prior knowledge. The access tiers Hot, Cool, Cold and Archive are introduced in "AZ-900 compact", lesson 2.5. Lesson 2.1 creates the storage account, and lesson 2.2 controls access. K3 module 3.6 shows blobs from .NET. Here the topic is management.
Create and configure containers
A container groups blobs, similar to a top-level folder; an account has any number of them. Anonymous access is enabled in two steps: First the account must allow anonymous access on individual containers (setting Allow enabling anonymous access on individual containers, lesson 2.1), then someone sets the container to anonymous read access. Microsoft recommends switching off the account setting; then anonymous access is impossible everywhere.
Portal way: account → Data storage → Containers → + Container, name, Anonymous access level (Private, Blob or Container), optionally Encryption scope (lesson 2.1) and Enable version-level immutability support. Command:
az storage container create --account-name <eindeutiger-name> `
--name belege --public-access off --auth-mode login
az storage blob upload --account-name <eindeutiger-name> --container-name belege `
--name beleg-001.txt --file ./beleg-001.txt --auth-mode login
--auth-mode login uses your Entra sign-in; for that you need a data role such as Storage Blob Data Contributor (lesson 1.3); the Owner role alone is not enough for data.
In Azure PowerShell: New-AzStorageContainer -Name belege -Context $ctx -Permission Off.